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In this study, we developed a document for managing Information 
Technology suppliers in hospitals. This document is used to ensure the 
proper management of IT suppliers in the hospital. Products and services in 
Information Technology have characteristics and specifications that are 
always up to date, making it difficult for non-IT people to understand. 
Hospitals whose main business in the health sector is often lack of human 
resources who understand IT. Observations and interviews were conducted in 
Indonesian hospital, to identify the characteristics and problems in supplier 
management. Control Objectives for Information and Related Technologies 
(COBIT), Information Technology Infrastructure Library (ITIL) and 
government regulations on supplier management were reviewed and 
combined as a benchmark and guidance on how supplier management 
activities are carried out. The result of the process is a Standard Operating 
Procedure (SOP) document. The parties involved in the supplier management 


process have evaluated the SOP document. From the results of the study, it is 
known that currently, the hospital is still focused on procedures procurement 
of goods and services that are government regulated. This study proposes 
some new activities that are not currently done by the hospital. 
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1. INTRODUCTION 

Although many studies have suggested that Information Technology (IT) can improve the quality of 
service and competitiveness [1]-[4], the applications of IT in hospitals are still lacking [5], [6]. The 
government encourages hospitals to leverage IT to support health services [7]. Although the IT 
implementation in hospitals is low, hospitals IT spending is increasing [8]. This is a challenge for hospitals to 
procure IT goods/services and manage suppliers. IT goods and services have special characteristics, but the 
majority of hospitals do not have adequate human resources [7]. This is an opportunities to introduce 
management of IT suppliers to hospitals. So that supplier management processes can put a priority on 
customer service. 

Several studies related to organizational governance have been conducted, both for public 
organizations [9]-[14] and for health organizations [15], [16]. There are several frameworks and standar 
commonly used to help organizations implement IT such as Control Objectives for Information and Related 
Technologies (COBIT), Information Technology Infrastructure Library (ITIL), and _ International 
Organization for Standardization (ISO). COBIT that emphasizes governance [17], ITIL that help 
organizations create recipes to run excellent services [18], and ISO provides products, services and systems 
specifications to ensure quality, safety and efficiency [19]. In this paper, we will only focus on using the 
COBIT and ITIL framework rather than using ISO standard, this is because we want to use practices that are 
generally employed [20]. We propose to use ITIL and COBIT to assist hospitals to develop standard 
operational procedures related to supplier management. This will facilitate the hospital in managing the 
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supplier, from the procurement process, contracting, service operations, supplier evaluation, contract 
termination, to continuous improvement in supplier management. Suppliers in the hospital need to be well 
managed because it will affect the services to the public. 

We will combine supplier management standards from ITIL and COBIT for hospital practice. 
Identify activities that have been done by the hospital to manage the supplier. Apply these standards to 
activities that are usually performed in hospitals.The purpose of this study is to establish working procedures 
to assist hospitals to manage suppliers in information technology. This document is important for the hospital 
in order to uphold the process for managing supplier. This minimizes the risks of service disruptions caused 
by contracts with suppliers.In this study, we conducted a case study at a government hospital located in 
Surabaya, Indonesia. We explore patterns based on activities undertaken at the hospital, to then integrate 
them with COBIT and ITIL standards regarding supplier management. We also consider government 
regulations related to procurement of goods/services. 


2. RESEARCH METHOD 

In this paper, we use the principle of design science research by creating an artifact to answer 
research questions [21]. Supplier management guide document is created to help the hospital to manage 
relationships with suppliers. To prepare the supplier management guide document, the steps taken are as 
follows: conducting observations and interviews in hospitals, Managing Suppliers based on IT Standars, 
Proccess Mapping, Preparation of New Procedures, and Evaluation of New Procedures. In this study, we 
conducted an observation, interview, and evaluation in one of the government hospitals located in Surabaya, 
Indonesia. 

Interviews were conducted in a semi-structured manner [22]. We asked and observed how the 
contract management with suppliers is implemented. we use best practice from COBIT and ITIL as the 
checklist of questions, how is the process done, ask if there have been any rules governing supplier 
management issues within the hospital. 

Conducting literature studies related to the management of suppliers such as COBIT, ITIL, and 
government regulations. Initially, we plan to only use Process Practice and Activity for Manage Supplier 
from COBITS and Activity of ITIL Supplier Management. But in practice, hospitals emphasize that the 
management of suppliers, especially on contractual issues must follow established rules and regulations 
Therefore we have to include government regulations on the procurement of goods and services as the basis 
for supplier management guide document. 

Mapping, compiling, and incorporating COBIT, ITIL, and government regulations are appropriate 
to the conditions and characteristics of the organization. We will evaluate the processes and activities of 
managing suppliers available in COBIT, ITIL and Government regulations. Each activity will be analyzed 
and grouped according to their similarity. It will be rearranged into new procedures documents. 

The evaluation is conducted through meetings with the involved parties, such as the head of IT 
team, the head of the Budget Program Planning, and the staff of the Procurement Services Unit. Evaluation is 
done to find out the shortcomings and weaknesses of documents that have been prepared, in order to make 
improvements. 


3. RESULTS 
3.1. Observation and Interviews Results 

The results of interviews and observations are as follows. Hospitals have no formal guidance for 
contract management for suppliers. Hospital relationships with suppliers are currently regulated in 
government regulations on the procurement of goods and services [23]. That regulation contains the detailed 
procedures for procurement of goods and services. There is a discussion of contract rules, but it does not fully 
cover what should be in the supplier contract. For IT contracts in hospitals, this exposes business risk. IT has 
an important impact on hospital services. However, hospitals do not have enough resources to effectively 
manage IT. Defining contract details becomes critical to avoid conflict. Some contract-related cases have 
occurred in hospitals, resulting in losses from both parties. A common obstacle is the lack of IT technical 
knowledge of the personnel responsible for contract management. Hospitals need to ensure that contract 
management with suppliers has passed the correct procedures. Hospitals need to ensure that contract 
management with suppliers has passed the correct procedures, including considering the contents of the 
contract.Hospitals have many IT services that need to be managed. This consists of three aspects: network, 
server, and software. Hospitals work with different external suppliers from initial assessment process to 
system installation. 
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3.2. Managing Suppliers based on IT Standars 

In this study, we use COBITS and ITIL standards to identify best practices in supplier management. 
COBIT5S defines the best practice of supplier management in APO 10 manage supplier process.this process 
recommends 5 Key Management Practices (KMP) in supplier management. This KMP includes [17]: identify 
and evaluate supplier relationships and contracts, select supplier, manage supplier relationships and contracts, 
manage supplier risk, and monitor supplier performance and compliance. There are several activities that 
need to be done within each KMP. This activity proposes on what to do, not how to do. We use the ITIL 
framework to describe how to do. COBITS Procces Practice and Activity for Manage Supplier depicted in 
Table 1. 


Table 1. COBITS Procces Practice and Activity for Manage Supplier [17] 








Key Management Activity Meuvitss 
Practice Code 
APO10.01-1 — Establish and maintain criteria relating to suppliers and supplier contracts. 
Identify and evaluate APO10.01-2 — Establish and maintain supplier and contract evaluation criteria 
supplier relationships and APO10.01-3 Identify, record and categorise existing suppliers and contracts 
contracts APO10.01-4 Periodically evaluate and compare the performance of existing and alternative 


suppliers 
APO10.02-1 Review all Supplier requests for information (RFI) and requests for proposals (RFP) 
APO10.02-2 Evaluate RFIs and RFPs 
APO10.02-3 — Select the supplier that best fits the RFP 
In the specific case of software acquisition, include and enforce the rights and 


pEOles obligations of all parties in the contractual terms. 
Select suppliers In the specific case of acquisition of development resources, include and enforce the 
APO10.02-5. Bat teen 
rights and obligations of all parties in the contractual terms. 
Obtain legal advice on resource development acquisition agreements regarding 
APO10.02-6 3 2 é ; 
ownership and licencing of intellectual property 
APO10.02-7 In the specific case of acquisition of infrastructure, facilities and related services, 
; include and enforce the rights and obligations of all parties in the contractual terms 
APO10.03-1 Assign relationship owners for all suppliers and make them accountable for the quality 


of service(s) provided. 
APO10.03-2 Specify a formal communication and review process 
APO10.03-3 Agree on, manage, maintain and renew formal contracts with the supplier. 


Manage supplier Within contracts with key service suppliers include provisions for the review of 


3 ; APO10.03-4 aire 
relationships and supplier site 
contracts APO10.03-5 Evaluate the effectiveness of the relationship and identify necessary improvements 
APO10.03-6 Define, communicate and agree on ways to implement required improvements to the 
relationship. 


APO10.03-7 __ Use established procedures to deal with contract disputes 
APO10.03-8 Define and formalise roles and responsibilities for each service supplier 
Manage risk relating to the supplier's ablility to deliver service efficiently, effectively, 


APO10.04-1 | : . 
Wanaeesudplicrsisk securely, reliably, and continually 
APO10.04-2 When defining the contract, provide for potential service risk by clearly defining 
: service requirements 
APO10.05-1 Define and document criteria to monitor supplier performance aligned with service 
: level agreements 
APO10.05-2 Monitor and review service delivery to ensure that the supplier is providing an 
Monitor susalice ; acceptable quality of service 
ee eee d APO10.05-3 Review supplier performance and value for money to ensure that they are reliable and 


competitive 
APO10.05-4 Request independent reviews of supplier internal practices and controls, if necessary. 
Record and assess review results periodically and discuss them with the supplier to 
APO10.05-5. . ie : 
identify needs and opportunities for improvement. 
APO10.05-6 _ Monitor and evaluate externally available information about the supplier. 


compliance 





ITIL described Supplier Management in the service design phase. Supplier Management is the 
process of ensuring all contracts with suppliers meet the organization's business needs, ensuring all suppliers 
meet their contract commitments, review contracts, and maintain relationships with suppliers.the activity of 
supplier management can be summarize in [18]: (a) definition of new supplier and contract requirement, (b) 
evaluation of new supplier and contracts, (c) supplier and contract categorization and maintenance, (d) 
estasblisment of new supplier and contracts, (e) supplier, contract, and performance management, (f) contract 
renewal or termination. Activity of ITIL supplier management is depicted in Table 2. 

We also consider government regulations (PP No. 54 th. 2010) on the procurement of goods and 
services [23] to ensure compliance with regulations. The regulation governs the procurement preparation 
process, selection planning for goods/services providers, controlling, monitoring, complaints, and sanctions. 
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Table 2. Activity of ITIL Supplier Management [18] 











Activity Code Sub-Activity 
Definition of new supplier and _ contract eMoLt Identify Business ne : steak ke 
‘ P SMO01-2 Produce a statement of requirement (soR) and invitation to tender (ITT) 
requirements : : 
SMO1-3 Ensure conformance to strategy/policy 
SMO02-1 identify method of purchase or procurement 
SM02-2 establish evaluation criteria 
Evaluation of new suppliers and contracts sMoz3 evaluate altmative options 
‘ SM02-4 Select 
SM02-5 Negotiate contracts,targets, and the terms and conditions. 
SMO02-6 agree and award the contract 
SMO03-1 Assess or reassess the supplier and contract 
Supplier and contract categorization and SMO03-2 ensure changes progressed through service transition 
maintenance of the SCMIS SMO03-3 categoriza the supplier 
SMO03-4 update SCMIS 
SMO03-5 ongoing maintenance of the SCMIS 
SM04-1 Set up the supplier service and contract 
Establishment of new supplier and contracts SM04-2 transition the service 
SM04-3 establish contracts and relationships 
SMO05-1 manage and control the operation and delivery of service/products 
SMO05-2 monitor and report 
Supplier, contract, and performance management Mie? reyieWeand.mp) poe : : 
a ° SMO05-4 manage the supplier and the relationship 
SMO05-5 review service scope against business need 
SMO05-6 plan for possible closure/renewal/extension 
SM06-1 Review 
contract renewal or termination SMO06-2 renegotiate and renew or terminate and/or transfer 
SMO06-3 transition to new supplier or to internal resources 





3.3. Proccess Mapping 


We combine processes and activities within ITIL, COBIT, and Government Regulations. We use 
ITIL activity as a combination baseline. The result of activity mapping can be seen in Table 3. 


Table 3. Procces and Activity Mapping 








Aktivitas Supplier Management ITIL COBIT 5 PP No. 54 Th 2010 
SMO1-1 APO10.02-1 BAB VI Bag. 6 Ps. 64 
Definition of new supplier and contract SMO1-2 APO10.02-2 BAB VI Bag. 10 Ps. 79 
requirements SMO01-3 - BAB IV Ps. 22 
SMO01-4 - - 
SM02-1 - BAB VI Bag. 3 Par. | Ps. 35 
SMO02-2 APO10.01-2 BAB VI Bag. 3 Par. 4 Ps. 48 
APO10.04-1 
eM? APO10.04-2 . 
SM02-4 APO10.01-4 - 
Evaluation of new suppliers and contracts Tene Se eaaap BAB VIB: AG. 10 Pa.7 Ps 80 
meee ; APO10.02-4 
APO10.02-5 
APO10.02-6 
sre APO10.02-7 5 
APO10.03-4 
APO10.03-8 
SM02-7 APO10.03-3 BAB VI Bag. 10 Par. 11 
SMO03-1 - - 
SMO03-2 APO10.04-2 - 
. : APO10.02-3 
Establishment of new supplier and SM03-3 APO10.05-1 . 
contacts APO10.05-5 
APO10.03-1 
a APO10.03-3 " 
SM04-1 - - 
Supplier and contract categorization and SM04-2 eo - 
maintenance of the SCMIS APO10.01-3 
SM04-3 - - 
SM04-4 - - 
SMO05-1 APO10.05-1 - 
APO10.05-2 
APO10.05-3 
SMO05-2 APO10.05-4 BAB XV Bag. 2 Ps. 116 
; APO10.05-5 
Supplier, contract, and performance APO10.05-6 
management SM05-3 ‘ BAB XV Bag. 1 Ps. 115 
SMO05-4 APO10.03-7 BAB XV Bag. | Ps. 115 
APO10.05-2 
oe APO10.05-3 
SM05-6 APO10.03-2 BAB VI Bag. 11 Par. 7 Ps. 94 
: 1 eke. SM06-1 APO10.05-3 BAB VI Bag. 11 Par. 6 Ps. 93 
contrac ene wal Ontermnanon SM06-2 APO10.05-5 BAB VI Bag. 11 Par. 6 Ps. 93 
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3.4. Preparation of New Procedures 

The new procedure is prepared based on the mapping of activities and processes from COBIT, ITIL, 
and government regulations. we made some adjustments in the preparation of the document. Some activities 
are changed, omitted, or combined. We defined there are 6 main processes of suppliers management in the 
hospital (Table 4), namely: identify business needs and business case preparation, procurement and 
evaluation of new suppliers contracts, initiation of new contract, categorization of supplier and contract, 
supplier and contract performance management, and contract renewal or termination. Standard Operating 
Procedure (SOP) document is then prepared based on identified processes and activities. We use the SOP 


format that has been used by the hospital. 


Table 4. Activity of New Procedures 





No. Work steps 


Related unit 





Activity for Identify business needs and business case preparation Procedure 





Identify the purchase / procurement method, arrange supplier selection method, and Set supplier selection 


1 

method 
2 Arrange procurement documents, Review the procurement document. 

Prepare the initial business case, including options (internal and external), cost, time range, target, profit 
3 and risk assessment etc, Communicate the initial business case to the IT / IT division, and make sure that 


business and IT parties approve the initial business case. 
Activity for Procurement and Evaluation of New Suppliers Contracts Procedure 
Arrange the evaluation criteria of the procurement document that contains the supplier-related 
considerations (services, capabilities (both personnel and organization), quality and costs, etc.), Accept 
the procurement document criteria that have been prepared, Evaluate procurement documents according 
to predefined evaluation process / criteria and make sure they are in line with applicable business policies 
/ policies, Maintain documentary evidence from the evaluation, and Verify references from potential 
vendors 
Evaluate the impact of suppliers / contracts and their potential risks to avoid errors that could result in 
losses (financial risks, business reputation, operations, regulators, laws), Plan how to address potential 
service risks by clearly defining service requirements, including software deed agreements, alternative 
suppliers, or standby agreements to mitigate possible supplier errors, intellectual property protection and 
security and legal and regulatory requirements. Compare the performance of suppliers and alternative 
suppliers. And Create an overall review. 
Select suppliers and contracts that best match the results of the procurement document evaluation, 
3 Document the decision, Communicate the decision, In any supplier relationship, establish the relationship 
owner for all suppliers responsible for the quality of service provided 
Negotiate contracts, targets and terms and conditions (including liability, closure, renewal, extension, 
dispute, transfer). Use and launch roles and responsibilities for each service supplier. When multiple 
4 suppliers work together to provide a service, consider allocating the main contractor role to one of the 
suppliers to be responsible for the contract as a whole. Get legal advice on approval of resource 
acquisitions related to ownership and licensing of intellectual property 


5 Approve the Contract 


Activity for Initiation of New Contract Procedure 

1 Supplier and contract service configuration and their information in the SCD (Supplier and Contract 
Database) and other enterprise systems. 
If the contract / project is the replacement of the old system, you should take and note the transition 
process so that the productivity of the system is not compromised. 

Activity for Categorization of Supplier and Contract Procedure 
Create and maintain criteria based on type, significance and criticality of suppliers and supplier contracts, 

i Document these criteria, Categorize suppliers, then determine how important the supplier is to the service 
providers and services provided by the business. Focus on the most important and priority suppliers. 


a Update SCD every change related to supplier and/or contract, Perform SCD maintenance 


Activity for Supplier and Contract Performance Management Procedure 


Define criteria to supervise supplier performance in accordance with the applicable agreement, 


: Document these criteria. 

2 Monitor and Reporting 

3 Review on a regular basis, Record and review the results periodically, Discuss with suppliers to identify 
needs and opportunities for improvement, and Implement planned improvements. 
Perform supplier and relationship management (formal / non-formal communication, risk, change, 

4 failure, repair, contact, and interface), Use established procedures to handle contract disputes, first if 


possible, use effective relationships and communications to address service issues, and Plan for possible 
extensions / updates / extensions. 

Activity for Contract Renewal or Termination Procedure 
If the contract is a Unit Price Contract and there is a possibility of extension, then Review, Record and 

1 value the results of the review, and Re-negotiate the results of the review and discuss with the supplier to 
identify needs and opportunities for improvement, renewal, or termination and / or transfer. 


Procurement Unit 
Commitment Maker 
Official 
Procurement Unit 


IT Unit 


Procurement Unit 


IT Unit 


Budget Program 
Planning 


Procurement Unit 
IT Unit 


Budget Program 
Planning 


Procurement Unit 
IT Uni 


IT Uni 


IT Uni 


IT Uni 


IT Uni 


IT Uni 


IT Uni 
IT Uni 








IT Uni 


IT Unit 
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3.5. Evaluation 

Evaluation is conducted to find out whether the SOP document of contract management has been 
well prepared and easy to understand. The evaluation also sees compatibility with field conditions in 
hospitals. The evaluation was done by reviewing the document using walkthrough method. A walkthrough is 
a type of document review which led by the author of the document and attended by peer groups [23]. The 
walkthrough held at the hospital on October 14, 2016. The walkthrough review was conducted by the head of 
IT team, head of the Budget Program Planning, and staff of the Procurement Services Unit. it aims to get a 
direct response from the person in charge of the activity in the SOP document of contract management. 
Comments and corrections to documents obtained in the review process. 

During an evaluation, a sequence of unfavorable work steps was found in the business identification 
and business case preparation activities. Improvements are made based on input from peer group based on 
experience and regulation. It’s also found some unfamiliar terms such as business case, system transition, and 
SCMIS (Supplier and Contract Management Information System). Some of those activities names and terms 
need to be adjusted. The person responsible for each activity is checked and adjusted. 

SOP document improvements are made to correct the deficiencies and errors found at the evaluation 
stage. Improvement of SOP document of supplier management including: Improvement of terms, sentence 
arrangement and word selection in SOP documents, Role and responsibilities mistakes were fixed, and 
improvement the sequence of activities steps. Peer group states that some processes are helpful in managing 
supplier’s contracts because they are very specific to IT issues, such as software, infrastructure, and 
development resources. 


4. DISCUSSION 

Based on observations and interviews, the hospital does not have standard procedures for managing 
IT suppliers. Procurement process of goods and services are still the main focus for the hospital in managing 
IT supplier. This is because the procurement procedure of goods and services has been regulated by the 
government; it makes the hospital prioritize to follow the regulation. The hospital is still done intuitively and 
unstructured procedure to manage supplier, except for the procurement process. 

The results of activity mapping using COBIT and ITIL indicate that the following activities of 
suppliers management should be performed: identify business needs and business case preparation, 
procurement and evaluation of new suppliers contracts, initiation of new contract, categorization of supplier 
and contract procedure, supplier and contract performance management, and contract renewal or termination. 
The majority of those activities have not been systematically conducted by hospitals. All those activities are 
formalized into SOP documents for IT supplier management. 

The IT supplier management SOP document is recognized to be very helpful to ensure technical 
specifications and quality of goods/services in the field of IT (software, infrastructure, development 
resources). This document provides discourse to the relevant parties regarding supplier management based on 
international standards. However, this work procedure can not be fully applied in the hospital yet. This is due 
to some limitations of rules and authority in applying new procedures. 

Implementation of SOP documents within organizations is problematic and often requires great 
effort; the complexity will increase according to the size of the organization. It takes willpower from top 
management to implement those changes [25]. In this study, we do not discuss the documents application 
into organization operation. Our scope of research is to create SOP documents to manage suppliers according 
to COBIT and ITIL standards. In its application, it is still necessary to adjust to the current conditions and 
need to consider some elements of IT success factors in organizations such as people, work processes, data, 
networks, and software. The toughest challenge of implementing The IT supplier management SOP 
document is the hospital's characteristics of implementing IT in its organization. As in research [26][27], the 
adoption of technology in healthcare organizations is bound to encounter obstacles such as organizational 
structures and legal restraints. Government hospitals tend to wait for regulations to implement a policy, not 
because of the need for competitive advantage [5]. This paper provides a perspective from the point of view 
of IT management in managing suppliers.there are several papers discussing supplier management from a 
technical point of view, for example [28] using integrated fuzzy MCDM to select and evaluate suppliers, 
selecting coal-fired supplier[29], and optimization of enterprise alliance in supply chain[30]. 

There are possibilities and opportunities to make the document into community practice. By making 
this document open to the community, readable by stakeholders at the hospital, and receiving advice on 
improvement based on hospital experience. In this way, knowledge of the IT suppliers’ management can be 
understood by interested parties. 

In general, the processes of procurement of goods and management of suppliers in hospitals have 
many in common. We believe that the document of supplier management procedures can be a model of 
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supplier management in Indonesian hospitals. The application of information technology in Indonesian 
hospitals has poor reception, less than 5% have adopted the Hospital Information System [5]. The 
government's impetus regarding the application of IT into the hospital will have an impact on the need for 
infrastructure preparation. It requires quality improvement in the procurement process of goods / services and 
supplier management. 


5. CONCLUSION 

Supplier management guide document was produced for the hospital. This document was derived 
from the merger of activities on supplier management (COBIT, ITIL, and Government Regulations on the 
procurement of goods and services). The limitation of this study is that the guidance document is still a 
model, based on case studies at a government hospital. Other than that this document can only be applied in 
Indonesia because it uses government regulation as a source of document-making. But we believe that our 
model is ready to be applied in other hospitals with little adjustment. In the process of making it, we have 
considered the general pattern of supplier management and government regulations regarding the 
procurement of goods and services. There is an opportunity to make this procedure document a community 
practice for managing IT suppliers in hospitals. By combining best practices in COBIT, ITIL, and 
government regulations, this document is useful for those who handle suppliers, especially IT. 
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